Apple macOS EUVD-2026-104741

Exploitation requires the attacker to already be able to run an application (local code execution) on an affected macOS host - specifically macOS Sequoia before 15.8 or macOS Tahoe before 26.7 - per the CVSS AV:L/PR:L metrics and the description 'An app may be able to cause unexpected system termination.' No remote vector and no network exposure exist. Limiting factors: the attacker needs local, low-privileged execution rather than remote access; the only achievable impact is denial of service (system termination), with no confidentiality or integrity effect (C:N/I:N); and systems patched to 15.8 or 26.7 are not affected.

This is a moderate-severity, availability-only flaw that signals should be read as a genuine low priority rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local attacker who already has the ability to run code/an app on the host and can only cause unexpected system termination - no confidentiality or integrity impact. All exploitation signals point the same direction: SSVC records Exploitation=none, Automatable=no, Technical Impact=partial, and the input provides no EPSS score, no CISA KEV listing, and no evidence of public exploit code. There is no conflict between signals here - the CVSS low-impact profile, the SSVC 'none/no/partial' triad, and the absence of KEV/POC all agree this is a non-prioritized DoS-class bug. The main caveat is missing data rather than conflicting data: EPSS is not supplied, so probability-of-exploitation cannot be quantified, and the 'app' in the description implies the attacker must already have local code execution, which the PR:L metric supports. Patch exists, so remediation is straightforward and risk is best treated as routine patch-cycle rather than emergency.

A local user runs a malicious or malformed application on a macOS host; the app triggers an out-of-bounds write (CWE-787) in an affected system component, corrupting memory and forcing an unexpected system termination (kernel panic or crash). Because the CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction, exploitation requires the attacker to already be able to execute an app on the machine, and the only observed outcome is denial of service - no public exploit code is identified at time of analysis.